search

matrix-org / matrix-federation-tester

Tester for matrix federation written in golang.
78 stars 17 forks source link

Don't follow CNAME records when looking up SRV records #79

Closed babolivier closed 5 years ago

babolivier commented 5 years ago

Fixes #43

babolivier commented 5 years ago

ok, looks plausible now, but what happens if all of the SRV targets are invalid?

It produces no connection report because it doesn't have any address to work with (which, now that I think about it, the reason I added this, so that it falls back to serverName:8448 if it can't find a valid SRV record).

richvdh commented 5 years ago

It produces no connection report

No report at all? What does the json actually look like?

so that it falls back to serverName:8448 if it can't find a valid SRV record).

well ok, but I don't think that is the right thing to do.

babolivier commented 5 years ago

No report at all? What does the json actually look like?

{
  "WellKnownResult": {
    "m.server": "",
    "result": "No .well-known found"
  },
  "DNSResult": {
    "SRVCName": "_matrix._tcp.abolivier.bzh.",
    "SRVRecords": [
      {
        "Target": "chat.abolivier.bzh.",
        "Port": 8448,
        "Priority": 10,
        "Weight": 0
      }
    ],
    "SRVError": null,
    "Hosts": {
      "chat.abolivier.bzh.": {
        "CName": "errol.brendanabolivier.com.",
        "Addrs": [],
        "Error": {
          "Message": "SRV record target chat.abolivier.bzh. is a CNAME record, which is forbidden (as per RFC2782)"
        }
      }
    },
    "Addrs": null
  },
  "ConnectionReports": {},
  "ConnectionErrors": {},
  "Version": {
    "name": "Synapse",
    "version": "0.99.3"
  },
  "FederationOK": true
}

It behaves as if there was no SRV record at all.

well ok, but I don't think that is the right thing to do.

What do you think would be the right thing to you? Looking at the spec:

If the /.well-known request returned an error response, and the SRV record was not found, an IP address is resolved using AAAA and A records. Requests are made to the resolved IP address using port 8448 and a Host header containing the <hostname>. The target server must present a valid certificate for <hostname>.

Which to me is what we do by defaulting to serverName:8448 if we can't find a valid SRV record.